Yes, establishing that “secret 0” (the credential which grants access to all the others) is a tough problem. In some scenarios it’s possible to at least avoid

Yes, establishing that “secret 0” (the credential which grants access to all the others) is a tough problem. In some scenarios it’s possible to at least avoid introducing another vault-specific credential. For example if your workload is running in a managed environment like AWS or Kubernetes, the platform provides a credential automatically (IAM role or service account). If the vault can recognize this platform credential and map it to a role defined in the vault, then you are using the platform credential as the “secret 0”. It’s still not completely idiot proof because you have to define the mapping between platform roles and vault roles, and define permissions between vault roles and secrets. And of course the detailed workflows for doing this vary between vaults.